Ghost SPN identity attacks expose the limits of event-only SIEM

At a glance

What this is: This analysis explains how Ghost SPN identity attacks evade event-only SIEM by compressing SPN abuse, Kerberos ticketing, cleanup, and privilege escalation into a short, fragmented sequence.

Why it matters: It matters because IAM, SOC, and NHI teams need correlation across identity actions, not isolated logs, if they want to catch fast-moving privilege abuse before it becomes a lateral movement problem.

Context

Ghost SPN attacks exploit a gap between identity activity and event review. The attack assigns a Service Principal Name to a user account, requests Kerberos tickets, removes the SPN, and then uses the stolen credentials for follow-on access.

Traditional SIEM logic is built around alerting on individual events, but identity abuse often only becomes visible when those events are stitched together across time. That makes this a governance problem as much as a detection problem, because the control assumption is that the signal will still exist when someone looks.

The article frames this as an identity intelligence issue, not a volume issue. The environment may have plenty of logs, but without cross-domain correlation the attack narrative never forms.

Key questions

Q: What breaks when SPN abuse is only reviewed as isolated events?

A: The attack story breaks apart. A temporary SPN change, a Kerberos ticket request, and a later logon can each look routine on their own, so the SIEM never reconstructs the credential theft sequence. Teams need correlation across identity changes and authentication activity, not separate event alarms.

Q: Why do transient identity paths create more breach risk than static vulnerabilities?

A: Transient identity paths are dangerous because they can connect a reachable service to an over-permissive role or token before the organisation notices. Static vulnerabilities may persist long enough to be patched, but ephemeral access can be abused inside a narrow window and then disappear, leaving limited evidence and little time for review.

Q: What are the signs that a Ghost SPN attack is underway?

A: Look for an SPN added to an account that should not host one, followed quickly by Kerberos ticket requests, an SPN removal, and then unusual logon or privileged group activity. The key indicator is the tight sequence, especially when the account is not a normal service identity.

Q: How should teams respond when identity abuse is detected in progress?

A: Teams should contain the abused identity first by revoking sessions, disabling compromised credentials, and checking for persistence through new accounts or OAuth grants. Then they should trace which privileges were used, because the real question is not just how the attacker entered, but what they can still reach.

Technical breakdown

How Ghost SPN abuse turns a normal SPN change into credential theft

A Ghost SPN attack abuses the way Kerberos service tickets are requested after a Service Principal Name is attached to an account. The attacker temporarily adds an SPN to a user account, triggers ticket requests, and extracts material that can be cracked offline, often before defenders can meaningfully review the change. The key technical trick is not the SPN itself, but the short-lived identity state that looks administrative in isolation. Once the SPN is removed, the forensic trail becomes harder to reconstruct from event logs alone.

Practical implication: teams need identity-level correlation that links SPN changes, ticket requests, and subsequent logons as one sequence.

Why event-only SIEM misses the attack story

Event-only SIEM sees discrete records such as SPN modification, Kerberos ticket issuance, and successful authentication, but not the relationship between them. That creates a false sense of normality because each event can map to a legitimate administrative pattern on its own. The failure is architectural: isolated event logic cannot reliably identify identity abuse that depends on timing, sequence, and rapid cleanup. This is why correlation and behavior analytics matter more than raw alert volume in this attack class.

Practical implication: detection logic should evaluate event sequences and identity context, not just individual log signatures.

How rapid cleanup creates anti-forensic ambiguity

Rapid SPN removal is an anti-forensic step that intentionally shortens the evidence window. By the time a defender inspects the account, the attacker may have already erased the condition that made the abuse detectable. That means the meaningful signal sits in the transition, not the steady state. In identity terms, the abuse is transient, but the downstream access can persist through credential reuse, privileged group assignment, or lateral movement after the original SPN is gone.

Practical implication: preserve and correlate identity-change telemetry before cleanup removes the visible condition that triggered the abuse.

Threat narrative

Attacker objective: The attacker wants short-lived, stealthy credential extraction that leads to lateral movement and privilege escalation before defenders can reconstruct the sequence.

1. Entry begins when an attacker temporarily assigns an SPN to a non-service account so Kerberos ticket activity can be induced without raising immediate suspicion.
2. Credential access follows when Kerberos service tickets are requested and the attacker uses the ticket material to extract usable credentials.
3. Escalation occurs when the compromised identity is used for suspicious logon activity and privilege expansion into higher-trust groups.
4. Impact is the ability to move laterally and operate with elevated access while the original SPN evidence has already been removed.

Breaches seen in the wild

• Sumo Logic breach 2023: A compromised credential opened a Sumo Logic AWS account; customers were told to rotate API keys and stored credentials. No data impact was found.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Event-only SIEM assumes the signal survives long enough to be reviewed. That assumption fails in Ghost SPN attacks because the abuse window can be over before the log review window begins. The result is not just missed detection, but a broken investigative model that expects identity abuse to remain visible as a durable artifact. Practitioners should treat sequence correlation as a core identity control, not an enhancement.

Ghost SPN is a short-lived identity state problem, not a log-volume problem. The article shows that SPN creation, ticket issuance, SPN removal, and logon can all look benign when viewed separately. The governance gap is that identity change events are not being interpreted as part of a coherent access narrative. NHI and IAM teams should reclassify transient identity state as a high-risk condition when the state change itself enables credential abuse.

Identity telemetry needs narrative correlation, not just detection thresholds. Gurucul's framing is a reminder that alerting on the event is too late if the identity condition has already vanished. This is where NHI governance and SOC operations meet: the control plane has to preserve the story of who changed what, when, and what access followed. Practitioners should demand investigation workflows that reconstruct identity actions across time.

Stealth Kerberoasting exposes the limits of control designs built for persistent accounts. The attack path depends on the expectation that a risky identity condition will remain present long enough to be inspected, certified, or remediated. That is exactly the wrong assumption for short-duration abuse of delegated identity state. The implication is that access governance for machine-adjacent identity activity must move closer to issuance and change events, not downstream review cycles.

Identity blast radius is the more useful metric than alert count. The article's 11-minute timeline matters because it shows how little time defenders have once temporary identity abuse begins. What matters to the programme is not how many alerts fired, but how much trust, privilege, and reach the identity gained before cleanup. Practitioners should measure how quickly identity change paths can be correlated to impact, not how many records are generated.

What this signals

Ghost SPN attacks expose a governance blind spot in event-driven monitoring. Identity operations can be completed and erased inside a short window, which means the control problem is not just detection latency but evidence durability. Programmes that still rely on review cycles to catch transient identity abuse are operating with the wrong assumption about how fast access can be weaponised.

Attack reconstruction is becoming a core identity capability. If the SOC cannot connect directory change, Kerberos, and logon activity into one narrative, the incident will look like routine noise. That pushes IAM, NHI, and detection engineering toward shared telemetry design and away from isolated control ownership.

For practitioners

• Correlate SPN changes to Kerberos activity Build detection logic that links SPN additions, ticket requests, SPN removals, and subsequent logons into a single identity sequence instead of treating each event separately.
• Flag transient SPN assignments on non-service accounts Treat short-lived SPN assignment on accounts that are not designated service identities as a high-risk identity change and route it for immediate investigation.
• Preserve identity-change telemetry before cleanup Retain AD modification data and Kerberos-related records long enough to reconstruct the attack order after the SPN has already been removed.
• Review delegated directory permissions Check who can modify SPNs and related directory attributes, then remove unnecessary WriteSPN and GenericAll pathways from accounts that do not need them.
• Hunt for privilege escalation after unusual ticketing Search for rapid group membership changes, unusual external logons, and downstream privileged access following suspicious Kerberos ticket activity.

Key takeaways

• Ghost SPN attacks succeed because the abuse window can be shorter than the review window, which breaks event-only monitoring models.
• The article's example shows how a temporary SPN change can become credential theft, stealth cleanup, and privilege escalation in roughly 11 minutes.
• Defenders need correlation across identity changes, ticket activity, and follow-on logons if they want to limit this attack path.

Key terms

• Ghost SPN: A Ghost SPN is a service principal name in Active Directory that points to a hostname that no longer resolves in DNS. It matters because the identity record still exists and can be abused to redirect authentication, even when the underlying service is gone.
• ServicePrincipalName: ServicePrincipalName is an Active Directory attribute that identifies the service or application associated with an account. In practice, it helps security teams locate service accounts during discovery and validate whether an account is still tied to a legitimate workload, which supports inventory and governance efforts.
• Kerberoasting: Kerberoasting is an Active Directory attack that targets service accounts by requesting Kerberos tickets and attempting to crack the underlying password offline. It is dangerous because weak service account passwords and excessive permissions can turn one ticket into elevated access across critical systems.
• Event-only SIEM: Event-only SIEM is a monitoring approach that treats each log record as an independent alert rather than a sequence of related identity actions. In fast identity abuse cases, that design misses the narrative because it lacks correlation across directory changes, authentication activity, and post-access behavior.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.